The System Theoretic Accident Modelling and Process (STAMP) of medical pilot knock-out events: pilot incapacitation and homicide-suicide

After the Germanwings flight 4U9525, mental health issues of pilots have been raised as a hazard to flight safety. Pilot homicide-suicide, as a special subtype of pilot incapacitation, can be examined at different levels of commercial aviation. We extended the System Theoretic Process Analysis (STPA), based on the System Theoretic Accident Modelling and Process (STAMP), to pilot behaviour to investigate how these knock-out events may be encountered in the whole system. Several safety actions have been identified to prevent hazardous pilot behaviour caused by medical incapacitation and homicidal-suicidal behaviour at different levels of the system. Pilot incapacitation is already handled very well in practice with respect to the regulations and procedures in current usage. In contrast, the prevention of pilot homicide-suicide is currently managed by aeromedical decision-making regulations and pilot support programs. The design of the flight deck compartment door and the balancing of privacy laws and public safety remain trade-offs amid a medical risk.